Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
  PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://yafferge.ru/strik?utm_term=acts+9+niv+bible+gateway In PDF document text

  • http://jurelireroxux.22web.org/multiplication_coloring_worksheets_for_kindergarten.pdfIn PDF document text
  • http://tuvuvadirozo.iblogger.org/abide_with_me_sheet.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4368496/normal_6011aca57611d.pdfIn PDF document text
  • http://gavuzusim.iblogger.org/hum_bihari_mp4_song.pdfIn PDF document text
  • https://static.s123-cdn-static.com/uploads/4377925/normal_5fca71cb18f66.pdfIn PDF document text
  • https://cdn-cms.f-static.net/uploads/4385235/normal_5fd7f1f5adb45.pdfIn PDF document text
  • http://lidagejelotodu.22web.org/stardew_valley_abigail_free_vacation_answer.pdfIn PDF document text
  • http://www.ascendercorp.com/In PDF document text
  • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
  • https://9c43cb74-45e3-47de-9527-fda2e8336169.filesusr.com/ugd/af0aa9_776c449a89c548b79ba54449b61b4e1c.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/4571aa03-1694-4bb9-b448-2d7714fbf9c9/how_to_brief_a_legal_case_example.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/6f433ffc-2e29-434d-adf2-7f850bc48109/how_to_use_universal_ac_remote_control.pdfIn PDF document text
  • https://aa3bb5c3-2bd4-4791-9e2a-6e31d5009b04.filesusr.com/ugd/60e703_7f3effa29d574bf998b51512a6a881e2.pdf?index=trueIn PDF document text
  • http://nupakavidowux.epizy.com/marcus_aurelius_meditations_kindle_free.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/f1b86a03-24b8-4ad5-89c3-752a57679689/what_are_the_strengths_and_weaknesses_of_a_research_study.pdfIn PDF document text
  • http://doroxokile.epizy.com/maintaining_the_confidentiality_of_suspicious_activity_reports.pdfIn PDF document text
  • https://uploads.strikinglycdn.com/files/8359a955-adcd-4646-ae77-e325aa8233ab/artificial_intelligence_with_python_prateek_joshi.pdfIn PDF document text
  • https://37991ae0-d72b-4ccf-bf90-288dedd591e7.filesusr.com/ugd/041b56_4899bc29b31f4a0fbc2299c088a93dc2.pdf?index=trueIn PDF document text
  • https://uploads.strikinglycdn.com/files/ca2b6835-05d3-4e8e-a55b-96a450482bf0/57193797516.pdfIn PDF document text
  • https://729282ec-1290-4cbc-9302-cf8a24acd4c7.filesusr.com/ugd/42c189_5da580e41f8f4fbdb286a8b402386edf.pdf?index=trueIn PDF document text
  • http://jiwepatifon.rf.gd/back_titration_of_aspirin_lab_report.pdfIn PDF document text
  • https://b64dd490-e5b9-492f-89ff-e398ecee904c.filesusr.com/ugd/5926b4_ef45cdc806cd47ffac5431b28a0b0546.pdf?index=trueIn PDF document text
  • http://nadalapaxizo.epizy.com/tuvopawexusogexakura.pdfIn PDF document text
  • http://zumewozuzetarun.epizy.com/tarot_decks_for_sale_amazon.pdfIn PDF document text
  • http://garapaf.epizy.com/zedoponijelowuxawu.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://scripts.sil.org/OFLIn PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.